{ config, pkgs, lib, ... }: let cfg = config.local.programs.browsers; hostAddress = "192.168.7.10"; localAddress = "192.168.7.11"; contPackages = lib.optional cfg.tor-browser.enable cfg.tor-browser.package ++ lib.optional cfg.librewolf.enable cfg.librewolf.package ++ lib.optional cfg.mullvad-browser.enable cfg.mullvad-browser.package; hostPackages = lib.flip map contPackages (p: let hostRunBrowser = pkgs.writeScript "cont-run-browser" '' host=browsers.containers if [ -z "$(ssh-keygen -F $host)" ]; then ssh-keyscan -H $host >> ~/.ssh/known_hosts fi ssh -o PubkeyAuthentication=no kira@$host $@ ''; hostBrowserScript = pkgs.writeScriptBin "${p.meta.mainProgram}" '' ${hostRunBrowser} ${p.meta.mainProgram} $@ ''; in pkgs.runCommand "${p.meta.mainProgram}" { } '' mkdir $out cp -r ${hostBrowserScript}/bin $out/bin cp -r ${p}/share $out/share '' ); isEnable = cfg.tor-browser.enable or cfg.librewolf.enable or cfg.mullvad-browser.enable; in { imports = [ ./tor-browser.nix ./mullvad-browser.nix ./librewolf.nix ]; config = lib.mkIf isEnable { environment.systemPackages = hostPackages; hardware.pulseaudio = { systemWide = true; support32Bit = true; tcp = { enable = true; anonymousClients.allowedIpRanges = [ "127.0.0.1" "192.168.7.0/24" ]; }; }; networking = { firewall = { allowedTCPPorts = [ 4713 ]; allowedTCPPortRanges = [ { from = 3000; to = 3999; } { from = 5000; to = 5999; } { from = 8000; to = 9999; } { from = 32000; to = 33999; } ]; trustedInterfaces = [ "ve-*" ]; }; nat = { enable = true; internalInterfaces = [ "ve-browsers" ]; externalInterface = "wg0"; }; }; containers.browsers = { autoStart = true; ephemeral = true; privateNetwork = true; inherit hostAddress localAddress; bindMounts = lib.mkMerge [ { "/tmp/.X11-unix" = {}; "/etc/ssh/keys" = { isReadOnly = false; hostPath = "/persistent/per-machine/browsers/etc/ssh/keys"; }; "/home/kira/Downloads" = { isReadOnly = false; hostPath = "/home/jan/downloads/browser"; }; "/run/opengl-driver/lib" = { }; "/run/opengl-driver-32/lib" = { }; } (lib.mkIf cfg.librewolf.enable { "/home/kira/.librewolf" = { isReadOnly = false; hostPath = "/persistent/per-machine/browsers/home/kira/.librewolf"; }; }) ]; config = { pkgs, ... }: { system.stateVersion = "23.11"; # Inherit configs from host networking.hosts = lib.mkMerge [ config.networking.hosts { "${hostAddress}" = [ "host" ]; } ]; fonts = { inherit (config.fonts) enableDefaultPackages packages; fontconfig = { inherit (config.fonts.fontconfig) defaultFonts; }; }; services.openssh = { enable = true; settings = { PasswordAuthentication = true; MaxAuthTries = 2; }; hostKeys = [ { bits = 4096; path = "/etc/ssh/keys/ssh_host_rsa_key"; type = "rsa"; } { path = "/etc/ssh/keys/ssh_host_ed25519_key"; type = "ed25519"; } ]; }; users.users.kira = { isNormalUser = true; home = "/home/kira"; password = "hello"; extraGroups = [ "pulse-access" ]; packages = contPackages; }; environment.sessionVariables = { DISPLAY = ":0"; PULSE_SERVER = "tcp:${hostAddress}:4713"; }; }; }; }; }